Skip to content
OpenAdvisories

Package · npm

vm2

78 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

9 results · Clear filters · Feed

  • Critical 9.0
    CVE-2026-100721 Public exploit

    vm2 before 3.12.2 Authorization Bypass via Custom Resolver

    vm2 before 3.12.2 contains an authorization bypass in the NodeVM external-module resolver. When an embedder configures `require.external` with a custom resolver (and `context: 'host'`), `LegacyResolver.customResolve` in lib/resolver-compat.js records the reso…

    patriksimek vm2 vm2 npm
  • Critical 10.0
    CVE-2026-92956 Public exploit

    vm2 3.10.1 through 3.11.6 Sandbox Escape via WebAssembly.compileStreaming

    vm2 versions 3.10.1 through 3.11.6 contain a sandbox escape reachable from a default `new VM()` sandbox when running on Node.js 26. WebAssembly.compileStreaming and WebAssembly.instantiateStreaming can produce a raw host-realm Promise that rejects with a host…

    patriksimek vm2 vm2 npm
  • Critical 9.0
    CVE-2026-92935 Public exploit

    vm2 NodeVM Remote Code Execution via Array-Shaped Require

    vm2 is a sandbox for running untrusted Node.js code. In versions >= 3.11.4 and <= 3.11.6, the NodeVM constructor computes `hasRealRequireConfig` with `typeof requireOpts === 'object' && requireOpts !== null`, so an array-shaped `require` value (for example `r…

    patriksimek vm2 vm2 npm
  • Critical 9.8
    CVE-2026-24118 Public exploit

    VM2 Sandbox Breakout Through __lookupGetter__

    vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.0, VM2 suffers from a sandbox breakout vulnerability. This allows attackers to write code which can escape from the VM2 sandbox and execute arbitrary commands on the host system. This issue h…

    patriksimek vm2 vm2 npm
  • Critical 9.8
    CVE-2023-37903 Public exploit

    Sandbox Escape in vm2

    vm2 is an open source vm/sandbox for Node.js. In vm2 for versions up to and including 3.9.19, Node.js custom inspect function allows attackers to escape the sandbox and run arbitrary code. This may result in Remote Code Execution, assuming the attacker has ar…

    patriksimek vm2 vm2 npm
  • Critical 9.8
    CVE-2023-32314 Public exploit

    Sandbox Escape

    vm2 is a sandbox that can run untrusted code with Node's built-in modules. A sandbox escape vulnerability exists in vm2 for versions up to and including 3.9.17. It abuses an unexpected creation of a host object based on the specification of `Proxy`. As a resu…

    patriksimek vm2 vm2 npm
  • Critical 9.8
    CVE-2023-30547 Public exploit EPSS 73%

    Sandbox Escape in vm2

    vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. There exists a vulnerability in exception sanitization of vm2 for versions up to 3.9.16, allowing attackers to raise an unsanitized host exception inside `handleException()…

    patriksimek vm2 vm2 npm
  • Critical 10.0
    CVE-2023-29017 Public exploit EPSS 63%

    vm2 Sandbox Escape vulnerability

    vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Prior to version 3.9.15, vm2 was not properly handling host objects passed to `Error.prepareStackTrace` in case of unhandled async errors. A threat actor could bypass the s…

    patriksimek vm2 vm2 npm
  • Critical 10.0
    CVE-2022-36067 Public exploit EPSS 48%

    vm2 vulnerable to Sandbox Escape before v3.9.11

    vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. In versions prior to version 3.9.11, a threat actor can bypass the sandbox protections to gain remote code execution rights on the host running the sandbox. This vulnerabil…

    patriksimek vm2 vm2 npm